Commit Graph

30845 Commits

Author SHA1 Message Date
Joseph Sutton
d83802e2d4 kdc: Fix log message typo 2023-06-20 18:02:15 -05:00
Joseph Sutton
c1bd7772ed third_party/heimdal: Fix deprecation messages
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-20 18:02:15 -05:00
Siva Mahadevan
a7019d4b88 kadmin/check: move error messages to stderr
This helps with certain automation tools, such as ansible, that usually
expect failure to be visible in stderr.

Other minor changes:
* replace "doesn't" with "does not" to keep messages consistent and
  avoid escaping quotes in grep, etc.
* add newlines
2023-06-20 13:16:19 -05:00
Robert Manner
e8e8b78d65 hx509/hxtool.c: ensure parse_bytes() result does not overflow 2023-06-20 12:57:28 -05:00
Robert Manner
37cd2c16b8 asn1/check-gen.c: disable some non working bignum tests on 32 bit systems 2023-06-20 12:57:28 -05:00
Robert Manner
56d97563f0 kcm,kdc/config.c: detect too big max_request sizes (>= 64 MB) 2023-06-20 12:57:28 -05:00
Robert Manner
65e5b0ab79 roken/parse_bytes: fix test for >= terabyte units on 32 bit systems
On 32 bit systems, sizeof(ssize_t) and sizeof(unsigned long aka UL) is
32 bits which is not able to hold the value of a terabyte.
2023-06-20 12:57:28 -05:00
Taylor R Campbell
997916e3f6 krb5: Make heimdal_version and heimdal_long_version const.
Pretty sure it is not useful for applications to be able to write to
this.

However, caveat: this could break programs that expect to pass around
&heimdal_version or &heimdal_long_version to functions that expect
pointers to non-const objects even if they don't modify them.
2023-06-20 12:19:48 -05:00
Taylor R Campbell
426eb46441 com_err: Constify xyz_error_strings arrays.
Note: This changes the types of public symbols.  It is unlikely that
any applications would rightly _write_ to these arrays, but it is
possible they might require some UNCONST in order to pass the
pointers to other functions that are missing const qualifiers.
2023-06-20 12:19:48 -05:00
Taylor R Campbell
c69ce29a31 krb5/constants.c: Make some constants constant.
This changes the public header file but I doubt it was ever intended
that applications could change these by writing to them.  (Not sure
why they're not declared as const arrays in any case.)
2023-06-20 12:19:48 -05:00
Taylor R Campbell
fdbf355be0 ipc/client.c: Make never-modified global ipcstable const. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
29b1faaef6 krb5/send_to_kdc.c: Constify plugin stuff. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
c644d051d8 krb5/pcache.c: Constify plugin stuff. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
1f870603a4 krb5/kuserok.c: Constify plugin stuff. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
2e3dada6fd krb5/krbhst.c: Constify plugin stuff. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
084d638906 krb5/db_plugin.c: Constify plugin stuff. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
da5730a4b0 krb5/aname_to_localname.c: Constify plugin stuff. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
6630cf5889 krb5/plugin.c: Constify. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
eb0d98ba34 base/plugin.c: Constify.
As a bonus, eliminate an unnecessary rk_UNCONST.
2023-06-20 12:19:48 -05:00
Taylor R Campbell
b67a083a3c krb5/send_to_kdc.c: Sprinkle const on global data never changed. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
796e420c11 libkrb5, libkdc: Constify salted s2k default iterator counts.
These externs should really be in a .h file shared by definition and
usage sites so the C compiler can verify that they match.
2023-06-20 12:19:48 -05:00
Taylor R Campbell
8f2f159f7f krb/pac.c: Sprinkle const on global data never changed. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
c2c47aec6c krb5/init_creds_pw.c: Sprinkle const on global data not changed. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
35688d030f krb5/get_in_tkt.c: Sprinkle const on global data never changed. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
cf0418d6fc krb5/get_host_realm.c: Sprinkle const on global data never changed. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
5d9723d52d krb5/context.c: Sprinkle const for global data never changed. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
9b61e64c3d krb5/changepw.c: Sprinkle const for global data never changed. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
043bb8f27d krb5/addr_families.c: Sprinkle const for global data never changed. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
72606cb95e libheimbase: Allow static const heim types. 2023-06-20 12:19:48 -05:00
Taylor R Campbell
2db6c29a3e krb5/mk_error.c: Constify and rk_UNCONST a static buffer.
This is almost certainly intended never to be written to, so let's
let the operating system detect that mistake for us by mapping it in
a .rodata segment mapped read-only that will cause SIGSEGV on write.

fix https://github.com/heimdal/heimdal/issues/1136
2023-06-20 12:19:48 -05:00
Taylor R Campbell
ca1200df03 krb5_decrypt_iov_ivec: Make sure const zero IV is actually const.
This way if anything _does_ write to it, it has the opportunity to be
caught by SIGSEGV, by having zero_ivec in a .rodata segment mapped
read-only.

fix https://github.com/heimdal/heimdal/issues/1135
2023-06-20 12:19:48 -05:00
Joseph Sutton
1b954faeeb kdc: Pass in HDB_F_ARMOR_PRINCIPAL when fetching armor ticket client principal
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-13 17:41:21 -05:00
Joseph Sutton
79f47ab3f3 hdb: Add flag to indicate a fetch for the client of an armor ticket
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-13 17:41:21 -05:00
Joseph Sutton
cf6b216868 kdc: Have caller pass HDB_F_FOR_TGS_REQ into _kdc_fast_check_armor_pac()
We shall soon want to use this function for AS-REQs as well as TGS-REQs.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-13 17:41:21 -05:00
Stefan Metzmacher
df848bfd97 kdc: don't announce KRB5_PADATA_GSS unless gss_preauth is enabled
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15273

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2023-06-12 12:41:02 -05:00
Stefan Metzmacher
eb388539ec kdc: don't announce KRB5_PADATA_PKINIT_KX unless anonymous is allowed
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15273

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2023-06-12 12:41:02 -05:00
Stefan Metzmacher
67a6eb3218 kdc: don't announce KRB5_PADATA_FX_FAST unless fast is enabled
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15273

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2023-06-12 12:41:02 -05:00
Jeffrey Altman
93454c885c roken: qsort provide ANSI C prototype for swapfunc()
K&R is no longer acceptable.
2023-06-06 09:55:27 -04:00
Jeffrey Altman
adde2e5b4b roken: snprintf properly account for char widths
If a char width is specified the number of output buffer bytes
consumed might be greater than one.   Update append_char() to
return the number of bytes consumed and use that value in xyzprintf()
instead of one.
2023-06-06 09:32:33 -04:00
Jeffrey Altman
c64d4ce968 krb5: krb5_enctype_to_keytype cast krb5_enctype to krb5_keytype
The struct _krb5_key_type.type is krb5_enctype.   Cast it to
krb5_keytype before assigning to the 'krb5_keytype *keytype'
output variable to avoid a warning from Clang 1500 on Darwin.
2023-06-06 09:11:29 -04:00
Nicolas Williams
692187e5d6 ipropd-slave: Fetch new credentials more often
If the master is unreachable for a while we can end up with expired
tickets that don't get refreshed, then ipropd-slave gets stuck until
it's manually restarted.
2023-05-31 13:57:32 -05:00
Nicolas Williams
658db1c2c2 kinit: Translate context init error codes (fix #1126) 2023-05-27 16:30:46 -05:00
Nicolas Williams
3e2c1c83b4 base: Translate context init error codes 2023-05-27 16:30:25 -05:00
Nicolas Williams
bc4e6591af base: Do support /dev/null as a config file 2023-05-27 16:30:25 -05:00
Nicolas Williams
9cbafd7320 kadmin: Add missing options to kadmin(1) page (fix #1118) 2023-05-26 23:52:24 -05:00
Taylor R Campbell
a142767598 Fix ctype.h misuse.
Excluded: libtomath and libedit files, most of which appear to be
testing or example code not involved in production, and which are
derived from an upstream that should perhaps have patches submitted
upstream instead.

fix https://github.com/heimdal/heimdal/issues/1111
2023-05-26 14:10:11 -05:00
Nicolas Williams
39f24c4cd4 krb5: Fix crash in resolving "DIR" as a ccache name (Fix #1108) 2023-05-26 13:47:26 -05:00
Nicolas Williams
7812c17f95 doc: Document KRB5CCNAME and KRB5_KTNAME 2023-05-26 13:24:06 -05:00
Nicolas Williams
b220338e80 admin: Document KRB5_KTNAME env var 2023-05-26 13:23:47 -05:00
Nicolas Williams
04933966e6 wind: Fix build (snprintf overflow warning in test) 2023-05-26 13:07:45 -05:00